CVE-2008-6171

N/A

Description

includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header.

CVE Details

CVSS v3.1 ScoreN/A

Published2/19/2009

Last Modified4/23/2026

Sourcenvd

Honeypot Sightings0

Affected Products

drupal:drupal

Weaknesses (CWE)

CWE-16CWE-20

References

http://drupal.org/files/sa-2008-067/SA-2008-067-5.11.patch(cve@mitre.org)

http://drupal.org/node/324824(cve@mitre.org)

http://secunia.com/advisories/32389(cve@mitre.org)

http://secunia.com/advisories/32441(cve@mitre.org)

http://www.securityfocus.com/bid/31900(cve@mitre.org)

http://www.vupen.com/english/advisories/2008/2913(cve@mitre.org)

https://exchange.xforce.ibmcloud.com/vulnerabilities/46049(cve@mitre.org)

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00783.html(cve@mitre.org)

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00826.html(cve@mitre.org)

http://drupal.org/files/sa-2008-067/SA-2008-067-5.11.patch(af854a3a-2127-422b-91ae-364da2661108)

http://drupal.org/node/324824(af854a3a-2127-422b-91ae-364da2661108)

http://secunia.com/advisories/32389(af854a3a-2127-422b-91ae-364da2661108)

http://secunia.com/advisories/32441(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/bid/31900(af854a3a-2127-422b-91ae-364da2661108)

http://www.vupen.com/english/advisories/2008/2913(af854a3a-2127-422b-91ae-364da2661108)

https://exchange.xforce.ibmcloud.com/vulnerabilities/46049(af854a3a-2127-422b-91ae-364da2661108)

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00783.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00826.html(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.